fix(#2469): supersede stale config-PR approval on PR update instead of skipping

hive-c0re/src/stores/approvals.rs

@@ -136,19 +136,29 @@ impl Approvals {
         Ok(())
     }
 
-    /// Return `true` when there is already a `pending` `merge_config_pr`
-    /// approval for `(agent, pr_number)`. Used by the polling fallback to
-    /// skip re-submitting approvals that were already queued by the webhook.
-    pub fn has_pending_merge_config_pr(&self, agent: &str, pr_number: u64) -> Result<bool> {
+    /// Return the `(id, fetched_sha)` of the pending `merge_config_pr`
+    /// approval for `(agent, pr_number)`, if one exists. Drives
+    /// `submit_merge_config_pr`'s idempotency + PR-drift handling: same
+    /// `fetched_sha` → no new request (the webhook + poll both call submit,
+    /// so re-submits of an unchanged PR must be no-ops); a drifted head →
+    /// cancel this stale row and queue a fresh approval.
+    pub fn pending_merge_config_pr(
+        &self,
+        agent: &str,
+        pr_number: u64,
+    ) -> Result<Option<(i64, Option<String>)>> {
         let conn = self.conn.lock().unwrap();
-        let count: i64 = conn.query_row(
-            "SELECT COUNT(*) FROM approvals \
-              WHERE agent = ?1 AND kind = 'merge_config_pr' \
-                AND commit_ref = ?2 AND status = 'pending'",
-            params![agent, pr_number.to_string()],
-            |row| row.get(0),
-        )?;
-        Ok(count > 0)
+        let row = conn
+            .query_row(
+                "SELECT id, fetched_sha FROM approvals \
+                  WHERE agent = ?1 AND kind = 'merge_config_pr' \
+                    AND commit_ref = ?2 AND status = 'pending' \
+                  ORDER BY id DESC LIMIT 1",
+                params![agent, pr_number.to_string()],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()?;
+        Ok(row)
     }
 
     /// Last `limit` resolved approvals (approved / denied / failed),